AIKIDO-2026-311440

officeparser is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) Pre-CVE Published 6 days ago

Medium Risk

This Affects:

officeparser

7.0.0 - 7.2.3

Fixed in 7.3.0

Are you affected? Scan for Free

TL;DR

officeParser converts parsed document content into HTML, Markdown, CSV, RTF, and PDF output, but its generators do not consistently neutralize text, attribute, URL, and CSS values taken from the untrusted source document. An attacker who supplies a crafted document can inject active markup or scripts into generated HTML and Markdown, smuggle formula/DDE payloads into generated CSV cells, and abuse script-executing URL schemes. The Puppeteer-based PDF generator also lets the headless browser fetch arbitrary remote resources referenced by the document, enabling server-side request forgery against internal services and cloud metadata endpoints, and deeply nested or oversized input can exhaust CPU and memory. The fix routes all generator output through a centralized sanitizer, blocks remote resource loading during PDF rendering, and caps parser recursion and decompression against actual inflated size.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you convert or render untrusted documents into HTML, Markdown, CSV, or PDF output.